Business Rules - GDPR Compliance (EN)

Core business rules of the personal-data protection domain (GDPR). Code BR-NNN, priority High/Medium/Low. The rules describe the compliance process and do NOT constitute legal opinions or binding interpretations of the law.

> Legal disclaimer: This section is for descriptive and informational purposes only. It does not constitute a legal opinion or a binding interpretation of the law. Always consult a qualified professional (professionista abilitato) before making operational decisions. Reference legal framework: GDPR Reg. (EU) 2016/679, Art. 5-6 (2016).

---

BR-001 - Every processing has a legal basis

Code: BR-001 Name: Legal Basis of Processing Description: Every Trattamento (processing) must rest on a valid BaseLegale (legal basis) among those of Art. 6 (consent, contract, legal obligation, vital interest, public interest, legitimate interest). Processing without a legal basis is not allowed. Rationale: Lawfulness is the prerequisite of every processing; absence of a basis is a structural breach. Priority: High Actors: TitolareTrattamento, DPO Traceability: GDPR Reg. (EU) 2016/679 Art. 6; glossary Legal Basis.

BR-002 - Data minimisation and purpose limitation

Code: BR-002 Name: Data Minimisation Description: Personal data collected must be adequate, relevant and limited to what is necessary for the purposes (Purpose Limitation). Collection "just in case" is not allowed. Rationale: Minimisation reduces risk and potential harm in case of a breach. Priority: High Actors: TitolareTrattamento Traceability: GDPR Reg. (EU) 2016/679 Art. 5(1)(c); glossary Data Minimisation.

BR-003 - Breach notification within 72 hours

Code: BR-003 Name: Data Breach Notification Description: A DataBreachReport that entails a risk to data subjects' rights and freedoms must be notified to the Supervisory Authority within 72 hours of becoming aware. If the risk is high, data subjects must be informed. Rationale: Timeliness limits harm and enables authority intervention. Priority: High Actors: TitolareTrattamento, DPO, Supervisory Authority Traceability: GDPR Reg. (EU) 2016/679 Art. 33-34; glossary Personal Data Breach.

BR-004 - Impact assessment (DPIA) for high-risk processing

Code: BR-004 Name: Mandatory DPIA Description: When a Trattamento may present a high risk to rights and freedoms (e.g. large-scale profiling, special categories), a DPIA must be carried out before starting the processing. Rationale: The DPIA identifies and mitigates risks before the processing produces effects. Priority: High Actors: TitolareTrattamento, DPO Traceability: GDPR Reg. (EU) 2016/679 Art. 35; glossary DPIA.

BR-005 - Exercise of data subject rights

Code: BR-005 Name: Data Subject Rights Description: The controller must be able to act on a DataSubjectRight (access, rectification, erasure, portability, restriction, objection) within one month, extendable in the cases provided. Erasure must propagate to all data stores. Rationale: Data subject rights are at the core of protection; their effectiveness requires processes and propagation. Priority: High Actors: TitolareTrattamento, Data Subject Traceability: GDPR Reg. (EU) 2016/679 Art. 15-22; glossary Data Subject Access Request, Right to Erasure.

BR-006 - Records of processing activities (RoPA)

Code: BR-006 Name: Record of Processing Activities Description: The controller (and processor) must maintain an up-to-date Records of Processing Activities (RoPA) documenting purposes, categories of data and subjects, recipients, transfers and retention periods. Rationale: The RoPA is the accountability tool that demonstrates compliance. Priority: Medium Actors: TitolareTrattamento, DPO Traceability: GDPR Reg. (EU) 2016/679 Art. 30; glossary Records of Processing Activities (RoPA).

BR-007 - International transfers with adequate safeguards

Code: BR-007 Name: International Transfers Description: A transfer of data to a third country requires a valid TransferMechanism (adequacy decision, SCC, BCR) and, where necessary, a transfer impact assessment (TIA). Rationale: Protection must follow the data even beyond EU borders. Priority: Medium Actors: TitolareTrattamento, DPO Traceability: GDPR Reg. (EU) 2016/679 Art. 44-49; glossary Standard Contractual Clauses (SCC), Adequacy Decision.

BR-008 - Adequate security of processing

Code: BR-008 Name: Security of Processing Description: The controller must adopt technical and organisational measures appropriate to the risk (e.g. encryption, pseudonymisation, access control) to ensure data integrity and confidentiality. Rationale: Security is the safeguard that prevents breaches and limits their effects. Priority: High Actors: TitolareTrattamento, ResponsabileTrattamento Traceability: GDPR Reg. (EU) 2016/679 Art. 32; glossary Integrity and Confidentiality, Pseudonymisation.